1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
//------------------------------------------------------------------------------
// <copyright file="FipsAwareEncryptedXml.cs" company="Microsoft">
// Copyright (c) Microsoft Corporation. All rights reserved.
// </copyright>
//------------------------------------------------------------------------------
namespace System.Configuration {
using System.Collections;
using System.Security.Cryptography;
using System.Security.Cryptography.Xml;
using System.Xml;
//
// Extends EncryptedXml to use FIPS-certified symmetric algorithm
//
class FipsAwareEncryptedXml : EncryptedXml {
public FipsAwareEncryptedXml(XmlDocument doc)
: base(doc) {
}
// Override EncryptedXml.GetDecryptionKey to avoid calling into CryptoConfig.CreateFromName
// When detect AES, we need to return AesCryptoServiceProvider (FIPS certified) instead of AesManaged (FIPS obsolated)
public override SymmetricAlgorithm GetDecryptionKey(EncryptedData encryptedData, string symmetricAlgorithmUri) {
// If AES is used then assume FIPS is required
bool fipsRequired = IsAesDetected(encryptedData, symmetricAlgorithmUri);
if (fipsRequired) {
// Obtain the EncryptedKey
EncryptedKey ek = null;
foreach (var ki in encryptedData.KeyInfo) {
KeyInfoEncryptedKey kiEncKey = ki as KeyInfoEncryptedKey;
if (kiEncKey != null) {
ek = kiEncKey.EncryptedKey;
break;
}
}
// Got an EncryptedKey, decrypt it to get the AES key
if (ek != null) {
byte[] key = DecryptEncryptedKey(ek);
// Construct FIPS-certified AES provider
if (key != null) {
AesCryptoServiceProvider aes = new AesCryptoServiceProvider();
aes.Key = key;
return aes;
}
}
}
// Fallback to the base implementation
return base.GetDecryptionKey(encryptedData, symmetricAlgorithmUri);
}
private static bool IsAesDetected(EncryptedData encryptedData, string symmetricAlgorithmUri) {
if (encryptedData != null &&
encryptedData.KeyInfo != null &&
(symmetricAlgorithmUri != null || encryptedData.EncryptionMethod != null)) {
if (symmetricAlgorithmUri == null) {
symmetricAlgorithmUri = encryptedData.EncryptionMethod.KeyAlgorithm;
}
// Check if the Uri matches AES256
return string.Equals(symmetricAlgorithmUri, EncryptedXml.XmlEncAES256Url, StringComparison.InvariantCultureIgnoreCase);
}
return false;
}
}
}
|
